<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div><br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"王华" <wanghua.humble@gmail.com><br><b>To: </b>"OpenStack Development Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org><br><b>Sent: </b>Tuesday, 8 September, 2015 11:36:15 AM<br><b>Subject: </b>Re: [openstack-dev] [keystone]how to get service_catalog<br><div><br></div><div dir="ltr">Hi Jamie,<div><br><div>We want to reuse the user token in magnum. But there is no convenient way to reuse it. It is better that we can use ENV['keystone.token_auth'] to init keystoneclient directly. Now we need to construct a auth_ref which is a parameter in keystoneclient init function according to ENV['keystone.token_auth']. I think it is a common case which service wants to reuse user token to do something like getting service_catalog. Can keystoneclient provide this feature? </div><div><br></div><div>Regards,</div><div>Wanghua </div></div></div></blockquote><div><br>Yes, that's exactly what ENV['keystone.token_auth'] is for. <br></div><div><br></div><div>You would need to create a session object [1] which can be on the process (long lived). Then when you create a client you pass Client(session=sess, auth=ENV['keystone.token_auth']). This works for all the clients i know of with the exception of swift. This will reuse the user's auth token and the user's service catalog. <br></div><div><br></div><div>For keystone there is an issue with doing this with the client.Client() object as it still wants a URL passed (there is a bug for this i can find if you're interested). If you are able to I recommend using client.v3.Client() directly. <br></div><div><br></div><div><br></div><div>Jamie<br></div><div><br></div><div><br></div><div>[1] https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L845<br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 7, 2015 at 12:54 PM, Jamie Lennox <span dir="ltr"><<a href="mailto:jamielennox@redhat.com" target="_blank">jamielennox@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br><br>
----- Original Message -----<br>
> From: "王华" <<a href="mailto:wanghua.humble@gmail.com" target="_blank">wanghua.humble@gmail.com</a>><br>
> To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
> Sent: Monday, 7 September, 2015 12:00:43 PM<br>
> Subject: [openstack-dev] [keystone]how to get service_catalog<br>
><br>
> Hi all,<br>
><br>
> When I use a token to init a keystoneclient and try to get service_catalog by<br>
> it, error occurs. I find that keystone doesn't return service_catalog when<br>
> we use a token. Is there a way to get service_catalog by token? In magnum,<br>
> we now make a trick. We init a keystoneclient with service_catalog which is<br>
> contained in the token_info returned by keystonemiddleware in auth_ref<br>
> parameter.<br>
><br>
> I want a way to get service_catalog by token. Or can we init a keystoneclient<br>
> by the token_info return by keystonemiddleware directly?<br>
><br>
> Regards,<br>
> Wanghua<br><br></div></div>Sort of.<br><br>
The problem you are hitting is that a token is just a string, an identifier for some information stored in keystone. Given a token at __init__ time the client doesn't try to validate this in anyway it just assumes you know what you are doing. You can do a variation of this though in which you use an existing token to fetch a new token with the same rights (the expiry etc will be the same) and then you will get a fresh service catalog. Using auth plugins that's the Token family of plugins.<br><br>
However i don't _think_ that's exactly what you're looking for in magnum. What token are you trying to reuse?<br><br>
If it's the users token then auth_token passes down an auth plugin in the ENV['keystone.token_auth'] variable[1] and you can pass that to a client to reuse the token and service catalog. If you are loading up magnum specific auth then again have a look at using keystoneclient's auth plugins and reusing it across multiple requests.<br><br>
Trying to pass around a bundle of token id and service catalog is pretty much exactly what an auth plugin does and you should be able to do something there.<br><br><br>
Jamie<br><br>
[1] <a href="https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L164" rel="noreferrer" target="_blank">https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L164</a><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br><br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br></blockquote></div><br></div><br>__________________________________________________________________________<br>OpenStack Development Mailing List (not for usage questions)<br>Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev<br></blockquote><div><br></div></div></body></html>